Deepfake Voice Calls and CEO Fraud: The AI-Powered Scam Every CFO Should Know

The Attack That Does Not Require a Hacked Email

Traditional CEO fraud works through email: an attacker spoofs an executive email address and instructs an employee to wire money urgently. Companies have gotten better at catching these. Attackers have adapted. Now they clone the executive voice using publicly available audio — a YouTube interview, a conference keynote, a company video — and call the target directly. The employee hears their CEO. The fraud succeeds.

Voice cloning tools that were research projects two years ago are now available as consumer applications. Generating a convincing voice clone requires as little as 30 seconds of source audio. The technology produces real-time audio that can be used live on a phone call. The attacks are particularly effective in high-pressure, short-deadline scenarios: "I need you to wire $85,000 to this account before end of business today."

Defense Requires Process, Not Just Technology

• Wire transfer verification policy: all wire transfers above a defined threshold require a callback to a known, pre-registered phone number — never to a number provided in the request
• No-exception urgency rule: legitimate urgent requests follow the same verification process as non-urgent ones. Attackers create urgency to bypass controls. Urgency is a red flag, not a reason to skip verification.
• Out-of-band confirmation: if a request comes by phone, confirm via a different channel (email, text, or in person). If it comes by email, confirm via phone to a known number.
• Voice safe word: establish a challenge word or phrase that executives use when communicating sensitive instructions — unknown to anyone outside a small circle
• Finance team training: run simulated vishing exercises so your team has experienced the pressure of a fraudulent call before encountering a real one
• Limit public audio of executives: be thoughtful about how much voice data of key decision-makers is publicly available online